The UK Information Commissioner's Office announced reprimands on Oct 20 (enforcement notices dated Oct 14) against Welsh altnet Ogi Networks Limited (ONL) and the Local Government Data Unit – Wales (Data Cymru), after a ransomware attack on Nov 1, 2024. The attacker got in through a test account, "Test2", that ONL created in January 2012 with the password "Password1". The account existed for more than 12 years and had either stayed active or been reactivated by mistake. The local administrator accounts on the three affected systems all shared the same password, unchanged since 2012, so hashes collected from one let the attacker move to the others. 182.7 GB was encrypted and 42 GB exfiltrated from a domain controller, a file server and a SQL server. The data, on 3,300 people, related to two projects supporting children and families.

The ICO found ONL breached UK GDPR Art. 32(1)(b) and (d): no password-strength requirements, no audits of the accounts it created, and no review of local admin accounts. Data Cymru breached Art. 28(4) and 32: no compliant sub-processor contract with ONL, no documented split of responsibility for the Active Directory service, and no routine account reviews. Both have since added MFA and periodic account reviews. These were reprimands, not fines. In the ICO's words: "Basic cyber security controls are not optional."